Notification of discovery activities

ABSTRACT

In some examples, a wireless device includes a wireless interface to communicate wirelessly with wireless networks, and at least one processor configured to monitor discovery activities for identifying services or devices of the wireless networks, and provide, to a target entity, a notification containing information relating to the monitored discovery activities.

BACKGROUND

Devices such as computers, handheld devices, or other types of devicescan communicate over wired or wireless networks. Wireless networks caninclude a wireless local area network (WLAN), which includes wirelessaccess points (APs) to which devices are able to wirelessly connect.Other types of wireless networks include cellular networks that comprisewireless access network nodes to which devices are able to wirelesslyconnect.

BRIEF DESCRIPTION OF THE DRAWINGS

Some implementations of the present disclosure are described withrespect to the following figures.

FIG. 1 is a block diagram of an example arrangement that includes awireless device and wireless networks, according to someimplementations.

FIG. 2 is a block diagram of components in a wireless device accordingto some implementations.

FIGS. 3 and 4 are flow diagrams of example processes according tovarious implementations.

DETAILED DESCRIPTION

In a wireless local area network (WLAN), a wireless device maycommunicate with one or multiple wireless access points (APs). Awireless AP (or more simply, an AP) can refer to a communication deviceto which a wireless device can establish a wireless connection tocommunicate with other endpoint devices. WLANs can include wirelessnetworks that operate according to the Institute of Electrical andElectronic Engineers (IEEE) 802.11 or Wi-Fi Alliance Specifications. Inother examples, WLANs can operate according to other protocols. Moregenerally, techniques or mechanisms according to some implementations ofthe present disclosure can be used with other types of wirelessnetworks, such as cellular networks or other wireless networks. In acellular network, an AP can refer to a wireless access network node,such as a base station or enhanced node B (eNodeB) in a cellular networkthat operates according to the Long-Term Evolution (LTE) standards asprovided by the Third Generation Partnership Project (3GPP). The LTEstandards are also referred to as the Evolved Universal TerrestrialRadio Access (E-UTRA) standards.

Examples of wireless devices include computers (e.g., tablet computers,notebook computers, desktop computers, etc.), handheld devices (e.g.smart phones, personal digital assistants, etc.), wearable devices(smart watches, electronic eyeglasses, head-worn devices, etc.), gameappliances, health monitors, vehicles (or equipment in vehicles), orother types of endpoint or user devices that are able to communicatewirelessly. More generally, a wireless device can refer to an electronicdevice that is able to communicate wirelessly.

A wireless device can perform discovery activities to identify availableservices or devices of wireless networks. Identifying available servicesor devices of wireless networks can include identifying informationrelating to the services or devices. Examples of information relating todevices of wireless networks can include any or some combination of thefollowing: information about the wireless networks, information aboutAPs, information about operators of APs, information about endpoint oruser devices in the wireless networks, and so forth. Examples ofinformation about services offered by wireless networks can include anyor some combination of the following: information of specific serviceproviders accessible through an AP, information about a cellular networkaccessible through an AP, information about capabilities of an AP,information about an authentication type used to perform authentication,information about an Internet Protocol (IP) address version or type thatcan be allocated, information about metrics of a connection between anAP and an external network (e.g., the Internet), information aboutcommunication protocols and ports of an AP, and so forth.

In the ensuing discussion, reference is made to performing discoveryactivities for services or devices of WLANs. However, techniques ormechanisms according to some implementations can be applied to discoveryactivities relating to other types of wireless networks.

In some examples, a discovery activity of a wireless device includesscanning for WLANs, where the scanning can include active scanning orpassive scanning. Active scanning can refer to a wireless device sendinga scan command, such as in the form of a Probe Request to locate an APof a WLAN. Passive scanning can refer to a wireless device listening toadvertisements from an AP, such as in the form of a Probe Response orBeacon, without the wireless device first sending any scan commands.

In other examples, other types of discovery activities can be performed.Such other discovery activities can involve sending queries according toother protocols, such as a Generic Advertisement Service (GAS) query, anAccess Network Query Protocol (ANQP) request, a Wi-Fi Direct protocol, aNeighbor Awareness Networking (NAN) query, a Fast Initial Link Setup(FILS) query, or other queries, together with the receiving of thecorresponding responses in response to the queries.

In some examples, GAS is a protocol provided by IEEE 802.11, andprovides over-the-air transportation for frames of higher-layeradvertisements between WLAN stations (STAs) (such as the wirelessdevice) or between a server in an external network and a WLAN station.The purpose of GAS is to enable a station to send a GAS query toidentify the availability of information related to network services ordevices of a wireless network, while the station is in a pre-associatedor unassociated state. GAS defines a generic container to advertisenetwork services information over an IEEE 802.11 network.

In further examples, the wireless device is able to send an ANQPrequest, which is a form of query, to an AP of a wireless network. Inresponse to the ANQP request, the AP can send to the wireless deviceinformation elements that describe the services or devices available atthe wireless network. The wireless device can use ANQP to obtain suchinformation without having to associate with the wireless network, e.g.,while the wireless device is in a pre-associated or unassociated state.

Another type of discovery activity can relate to discovery performedaccording to Wi-Fi Direct, which provides a mechanism for a peer-to-peer(P2P) network built on top of an IEEE 802.11 WLAN protocols. Wi-FiDirect is also referred to as “Wi-Fi P2P,” which is specified bystandards provided by the Wi-Fi Alliance. An arrangement of wirelessdevices that are able to communicate according to Wi-Fi Direct includesa P2P Group Owner (GO) and P2P client devices. In terms of behavior atLayers 1 to 3, the GO operates as an AP, while the client devicesoperate as non-AP STAs. The differences between Wi-Fi Direct operationsand regular IEEE 802.11/Wi-Fi operations include discovery and groupformation procedures. Once a Wi-Fi Direct group is formed and operating,the operation of the Wi-Fi Direct group is similar to operationaccording to IEEE 802.11 in which a traditional fixed AP is used.

NAN relates to a network that can be established among wireless devicesthat are in close proximity. A NAN query can be sent by the wirelessdevice to discover other NAN devices or services of a wireless network.

An FILS query can be sent by the wireless device to establish a wirelessconnection with a wireless network within a relatively short timeduration, e.g., 100 milliseconds. FILS allows for discovery by thewireless device of an AP of a wireless network to allow forestablishment of a wireless link.

Discovery activities performed by a wireless device can cause certaininformation relating to the wireless device to be exposed. Suchinformation can correspond to Personally Identifying Information (PII)or Personal Correlated Information (PCI) since information about thedevice is information about the user of the device. For example,location information of the wireless device can be exposed, since thedetection of messages transmitted by the wireless device duringdiscovery activities can allow for an entity that is monitoring a WLANto determine the approximate location of the wireless device. Such anentity can be an electronic device of a passive attacker that wishes todetermine wireless devices within the vicinity of the attacker.

Another issue associated with discovery activities of a wireless deviceis that certain third party applications that may run on the wirelessdevice may attempt to initiate discovery activities of the wirelessdevice to collect information or PII relating to the wireless device,such as the location of a wireless device. The third party applicationmay then attempt to send such location information back to a developerof the third party application, an advertisement network affiliated withthe application, or some other entity that is external of the wirelessdevice.

In addition to the possibility of exposing information of a wirelessdevice due to discovery activities, it is noted that discoveryactivities can also cause increased power consumption at the wirelessdevice that can deplete a battery of the wireless device.

In accordance with some implementations of the present disclosure, amechanism can be added to a wireless device to monitor discoveryactivities that may be initiated by an application executing in thewireless device. An application can refer generally to any programincluding machine-readable instructions that can be loaded in thewireless device. For example, a user may download an application to thewireless device. Alternatively, the wireless device can be pre-loadedwith an application.

FIG. 1 is a block diagram of an example arrangement that includes awireless device 102 and multiple WLANs 104-1 and 104-2. The WLAN 104-1includes an AP 106-1, and the WLAN 104-2 includes an AP 106-2. Althoughjust one AP is shown as being part of each WLAN, it is noted that inother examples, multiple APs can be included in a WLAN. Moreover, eventhough just two WLANs are depicted in FIG. 1, it is noted that in otherexamples, more than two WLANs or just one WLAN may be in thecommunication range of the wireless device 102.

The wireless device 102 includes a number of applications 108 that canexecute in the wireless device 102. One or more of these applications108 can perform discovery activities to identify services or devices ofWLANs that are within the communication range of the wireless device102, such as the WLANs 104-1 and 104-2. The discovery activities cancause discovery messages 107 to be communicated between the wirelessdevice 102 and one or more of the APs 106-1 and 106-2 in the WLANs 104-1and 104-2, respectively. A discovery message can refer to any messagethat is communicated between the wireless device 102 and a WLAN (orother type of wireless network) as part of a discovery activity, wherethe discovery message can include a request sent by the wireless device102, or a response sent by the wireless device 102 in response to arequest from a WLAN (or other type of wireless network. The discoverymessage can refer to an entire message or an information element withina message.

As noted above, a passive attacker device 110 can be present in acommunication range of at least one of the WLANs 104-1 and 104-2, suchas the passive attacker device 110 that is in the communication range ofthe WLAN 104-2. Note that the passive attacker device 110 may or may notbe associated with the WLAN 104-2. The passive attacker device 110 isable to operate on a channel of the WLAN 104-2, such that the passiveattacker device 110 is able to receive communications of other deviceson the channel. The passive attacker device 110 can monitor the wirelesscommunication medium between the wireless device 102 and the WLAN 104-2,and can detect discovery messages that are exchanged between thewireless device 102 and the WLAN 104-2.

In other examples, a particular application 108 may collect informationof the wireless device 102 based on discovery activities initiated bythe particular application 108, so that the particular application 108can communicate the information (such as the location of the wirelessdevice 102, PII, PCI, or other information) to a remote entity, such asthe developer of the particular application 108 or some other entity.

In accordance with some implementations of the present disclosure, adiscovery monitoring engine 112 can be provided in the wireless device102 to monitor discovery activities of the wireless device 102. Thediscovery monitoring engine 112 can be implemented with a hardwareprocessing circuit, or as a combination of machine-readable instructionsexecutable on the hardware processing circuit.

The discovery monitoring engine 112 can provide, to a target entity, anotification containing information relating to the monitored discoveryactivities. The target entity can be an entity that resides in thewireless device 102, or an entity that is external of the wirelessdevice. For example, the target entity can include a user interface topresent the notification (where the user interface is displayed in adisplay of the wireless device 102), an operating system in the wirelessdevice 102, a designated application in the wireless device 102, anapplication programming interface (API), or any other entity in thewireless device 102. Sending a notification to the API can cause thenotification to be sent or forwarded to another entity, whether insidethe wireless device 102 or external of the wireless device 102.

An external target entity can include a mobile device management (MDM)service that is used for administering wireless devices. For example, anMDM service can be used to ensure that users of wireless devices stayproductive and are not breaching corporate policies. An MDM service canalso perform configuration of wireless devices. In other examples, thediscovery monitoring engine 112 is able to send a notificationcontaining information relating to monitored discovery activities toanother type of external entity, such as a remote server.

The wireless device 102 includes a wireless interface 114 to communicatewirelessly with other devices, such as the APs 106-1 and 106-2. Thewireless interface 114 can include a wireless transceiver, such as aradio frequency (RF) transceiver, to transmit and receive wirelesssignals. Although not shown, the wireless device 102 can also includeprotocol layers to allow the wireless device 102 to communicateaccording to respective protocols over a wireless link through thewireless interface 114.

FIG. 2 is a block diagram of an example wireless device 102 according tofurther implementations. The wireless device 102 includes a driver 202for the wireless interface 114. The driver 202, which can be implementedas machine-readable instructions, is an interface between programs inthe wireless device 102 and the hardware of the wireless interface 114.In accordance with some implementations of the present disclosure, thedriver 202 includes logging logic 204 that can be used to loginformation 206 of discovery activities performed by the wireless device102. The logged information 206 of discovery activities can be stored inthe wireless device 102, such as in a storage medium 208 in the wirelessdevice 102.

Logged information of a discovery activity can include any one or moreof the following: information of a discovery message (such as adiscovery query or discovery response) that was transmitted by thewireless device 102, as part of the discovery activity, a time of thediscovery activity, such as the start time and/or the completion time ofa discovery activity, a location of the discovery activity, a channellist (which lists one or more channels of a wireless link used in thediscovery activity), a network address, such as a Medium Access Control(MAC) address or Internet Protocol (IP) address, information identifyingthe type of discovery activity (e.g., active scan, passive scan, GASdiscovery, ANQP discovery, Wi-Fi Direct discovery, NAN discovery, FILSdiscovery, etc.), and so forth.

In some examples, the logged information of a discovery activity canalso include information identifying the application 108 that initiatedthe discovery activity. The information identifying the application 108can include a name of the application 108, or any other information thatcan be used to derive an identity of the application 108. Theinformation identifying the application 108 that initiated the discoveryactivity can be used to determine whether an application that is notauthorized or that should not be initiating discovery activities iscausing such discovery activities to occur.

The wireless device 102 can also include a discovery applicationprogramming interface (API) 210, which includes routines that can beinvoked by an application 108 to perform a discovery activity throughthe wireless interface 114. For example, the application 108 can invokea routine in the discovery API 210 to transmit a discovery message (suchas a discovery request) through the driver 202 and the wirelessinterface 114 and then receive any corresponding replies.

Discovery messages passed through the driver 202 are logged by thelogging logic 204 of the driver 202 to provide the logged information206 of discovery activities.

The wireless device 102 can also include a monitoring application 212and a monitoring API 214. The monitoring application 212 and themonitoring API 214 can be part of the discovery monitoring engine 112 ofFIG. 1. The monitoring API 214 includes routines that can be invoked bythe monitoring application 212 to subscribe to events of the driver 202,including events relating to discovery activities. For example, themonitoring application 212 can use the monitoring API 214 to subscribeto events relating to logged discovery activities, so that the driver202 can send the information of logged discovery activities to themonitoring application 212.

The wireless device 102 further includes a processor 216 (or multipleprocessors). Machine-readable instructions are executable on theprocessor(s) 216, including machine-readable instructions of themonitoring application 212, the monitoring API 214, the driver 202, theapplication 108, and the discovery API 210. A processor can include amicroprocessor, a core of a multi-core microprocessor, amicrocontroller, a programmable integrated circuit, a programmable gatearray, or another hardware processing circuit.

FIG. 3 is a flow diagram of an example process that can be performed bythe wireless device 102, in accordance with some implementations. Theprocess includes logging (at 302) information of discovery activitiesperformed by the wireless device to identify services or devices ofwireless networks. In some examples, the logging can be performed by thedriver 202 of FIG. 2. The discovery activities that can be monitored caninclude one type of discovery activities (e.g., active scans by thewireless device 102) or multiple different types of discovery activities(e.g., active scans, passive scans, GAS discovery, ANQP discovery, Wi-FiDirect discovery, NAN discovery, FILS discovery, etc.).

The process further includes determining (at 304) whether the loggeddiscovery activities cause violation of at least one rule or policy.Note that in some examples, the terms “rule” and “policy” are usedinterchangeably. In other examples, a policy can include one or morerules. The at least one rule can include one or more of the following: athreshold relating to a number or rate of discovery activities, athreshold relating to power consumption, a threshold relating to abattery level, a rule relating to whether or not specific applicationsare allowed to initiate discovery activities, or any combination of theforegoing.

Thus, for example, a violation of the at least one rule is indicated inresponse to detecting that the number of discovery activities (e.g.,number of discovery messages sent by the wireless device 102) exceedsthe discovery activity threshold. As another example, a violation of theat least one rule is indicated in response to detecting that powerconsumption of the wireless device 102 that may be caused by discoveryactivities exceeds the power consumption threshold. As a furtherexample, a violation of the at least one rule is indicated in responseto detecting that a level of the battery in the wireless device 102 hasfallen below the battery level threshold. As yet a further example, aviolation of the at least one rule is indicated in response to detectingthat an application that triggered a discovery activity should not havedone so (e.g., the application is identified as one which does notnormally trigger a discovery activity by the wireless device 102).

In response to determining that the logged discovery activities causeviolation of the at least one rule, the process further includesproviding (at 306), to a target entity, a notification of the loggedinformation of the discovery activities. As discussed above, the targetentity can be located in the wireless device 102, or can be external ofthe wireless device 102.

Tasks 304 and 306 can be performed by the monitoring application 212 insome examples.

In some examples, the logged information of discovery activities can befiltered by a third party application (an application in the wirelessdevice 102 that has triggered discovery activities) or by monitoringservice (e.g., an MDM service). The filtering can cause only loggedinformation of discovery activities for a specific third partyapplication (of multiple third party applications) or for a specificmonitoring service (of multiple monitoring services) to be analyzed forrule violation and potential notification.

In examples where there are multiple target entities that may beinterested in receiving notifications of logged discovery activities,then respective different monitoring policies can be specified for themultiple target entities. For example, there can be multiple MDMservices, or one or more MDM services and one or more internal targetentities in the wireless device 102. Each of the different monitoringpolicies can include respective rule(s) governing whether there is aviolation caused by the monitored discovery activities.

FIG. 4 is a flow diagram of an example process according to furtherimplementations. The process of FIG. 4 includes filtering (at 402)information of discovery activities performed by the wireless device 102to remove personal identifying information to produce filtered discoveryinformation (which can include a subset of the information of thediscovery activities). The filtering can be applied by the logging logic204 (FIG. 2), or alternatively, the filtering can be applied by themonitoring application 212 (FIG. 2), in some examples.

An example of the personal identifying information that is filtered(deleted, scrambled, encrypted, or otherwise rendered un-decipherable orinaccessible) is a personal service set identifier (SSID). In otherexamples, personal identifying information such as a network address(e.g., MAC address or IP address) or a username can be filtered. Moregenerally, “personal identifying information” can refer to anyinformation that can be used to derive an identity of the wirelessdevice 102 or the user of the wireless device 102.

The process includes logging or providing notification (at 404) of thefiltered discovery information. In examples where the filtering isapplied by the logging logic 204, then the logged information 206 (FIG.2) of discovery activities includes the filtered discovery information.Since the logged information 206 includes the filtered discoveryinformation, the notification that is sent to a target entity would alsoinclude the filtered discovery information. In other examples, thelogged information 206 of discovery activities is not filtered, butinstead, the monitoring application 212 can perform the filtering suchthat the notification that is provided to a target entity includes thefiltered discovery information.

In further examples, filtering of personal identifying information caninvolve scrambling a network address, such as a MAC address or IPaddress. The scrambling involves translating network addresses inmessages of the discovery activities to translated network addresses.The translating can be performed by the logging logic 204 (FIG. 2) orthe monitoring application 212 (FIG. 2), in some examples. Thetranslating can be performed by using an address translation table,which translates between real network addresses and translated networkaddresses.

In such examples, the logging performed by the logging logic 204 caninvolve logging of the translated network addresses rather than the realnetwork addresses, or the notification provided to the target entityincludes the translated network addresses but not the real networkaddresses.

A storage medium (e.g., storage medium 208 in FIG. 2) for storingmachine-readable instructions can include one or multiple differentforms of memory including semiconductor memory devices such as dynamicor static random access memories (DRAMs or SRAMs), erasable andprogrammable read-only memories (EPROMs), electrically erasable andprogrammable read-only memories (EEPROMs) and flash memories; magneticdisks such as fixed, floppy and removable disks; other magnetic mediaincluding tape; optical media such as compact disks (CDs) or digitalvideo disks (DVDs); or other types of storage devices. Note that theinstructions discussed above can be provided on one computer-readable ormachine-readable storage medium, or alternatively, can be provided onmultiple computer-readable or machine-readable storage media distributedin a large system having possibly plural nodes. Such computer-readableor machine-readable storage medium or media is (are) considered to bepart of an article (or article of manufacture). An article or article ofmanufacture can refer to any manufactured single component or multiplecomponents. The storage medium or media can be located either in themachine running the machine-readable instructions, or located at aremote site from which machine-readable instructions can be downloadedover a network for execution.

In the foregoing description, numerous details are set forth to providean understanding of the subject disclosed herein. However,implementations may be practiced without some of these details. Otherimplementations may include modifications and variations from thedetails discussed above. It is intended that the appended claims coversuch modifications and variations.

What is claimed is:
 1. A wireless device comprising: a wirelessinterface to communicate wirelessly with wireless networks; and at leastone processor configured to: monitor discovery activities foridentifying services or devices of the wireless networks, the discoveryactivities comprising a discovery message transmitted by the wirelessdevice to a wireless network of the wireless networks; determine whetherthe discovery activities cause violation of at least one rule; andresponsive to determining that the discovery activities cause violationof the at least one rule, provide, to a target entity, a notificationcontaining information relating to the monitored discovery activities,the information contained in the notification comprising information inthe discovery message transmitted by the wireless device as part of thediscovery activities.
 2. The wireless device of claim 1, wherein thediscovery activities comprise scanning for the services or devices ofthe wireless networks.
 3. The wireless device of claim 1, wherein thediscovery activities comprise Generic Advertisement Service (GAS)activities, Access Network Query Protocol (ANQP) activities, Wi-FiDirect activities, Neighbor Awareness Networking (NAN) activities, andFast Initial Link Setup (FILS) activities.
 4. The wireless device ofclaim 1, wherein the target entity to which the notification is providedcomprises one or more of a user interface to present the notification,an operating system in the wireless device, an application program inthe wireless device, an application programming interface (API), and aremote entity external of the wireless device and accessible over anetwork.
 5. The wireless device of claim 1, wherein the at least oneprocessor is configured to log the information relating to the discoveryactivities along with information identifying an application thatinitiated the discovery activities.
 6. The wireless device of claim 1,wherein the information of the discovery message included in thenotification comprises information of the discovery message transmittedby the wireless interface to identify the services or devices of thewireless networks.
 7. The wireless device of claim 1, wherein the atleast one rule comprises one or more of a threshold relating to powerconsumption, or a threshold relating to a battery level.
 8. The wirelessdevice of claim 1, wherein the monitoring of the discovery activitiescomprises monitoring different types of discovery activities.
 9. Thewireless device of claim 1, wherein the at least one processor isconfigured to: filter information of the discovery activities to removepersonal identifying information to produce filtered discoveryinformation, wherein the notification provided to the target entitycomprises the filtered discovery information.
 10. The wireless device ofclaim 1, wherein the at least one processor is configured to: translatenetwork addresses in the message of the discovery activities totranslated network addresses, wherein the notification provided to thetarget entity comprises the translated network addresses but not thenetwork addresses.
 11. The wireless device of claim 1, furthercomprising: a driver to log the information relating to the discoveryactivities; and machine-readable instructions executable on the at leastone processor to receive the information logged by the driver.
 12. Thewireless device of claim 11, further comprising an applicationprogramming interface, the machine-readable instructions executable onthe at least one processor to use the application programming interfaceto subscribe to events corresponding to the discovery activities.
 13. Awireless device comprising: a wireless interface to communicatewirelessly with wireless networks; and at least one processor configuredto: monitor discovery activities for identifying services or devices ofthe wireless networks; determine whether the discovery activities causeviolation of at least one rule; and responsive to determining theviolation of the at least one rule, provide, to a target entity, anotification containing information relating to the monitored discoveryactivities, the information contained in the notification comprisinginformation in a message transmitted by the wireless device as part ofthe discovery activities, wherein the information contained in thenotification further comprises information identifying a type of thediscovery activities, the information identifying the type of thediscovery activities selected from among information identifying anactive scan, information identifying a passive scan, informationidentifying a Generic Advertisement Service (GAS) discovery, informationidentifying an Access Network Query Protocol (ANQP) discovery,information identifying a Wi-Fi Direct discovery, informationidentifying a Neighbor Awareness Networking (NAN) discovery, andinformation identifying a Fast Initial Link Setup (FILS) discovery. 14.The wireless device of claim 1, wherein the information contained in thenotification further comprises a location of the discovery activities.15. The wireless device of claim 1, wherein the information contained inthe notification further comprises information identifying anapplication that initiated the discovery activities.
 16. A methodperformed by a wireless device, comprising: monitoring discoveryactivities for identifying services or devices of wireless networks;determining whether the discovery activities cause violation of at leastone rule; and responsive to determining the violation of the at leastone rule, providing, to a target entity, a notification containinginformation relating to the monitored discovery activities, theinformation contained in the notification comprising information in amessage transmitted by the wireless device as part of the discoveryactivities, wherein the information contained in the notificationfurther comprises information identifying a type of the discoveryactivities, the information identifying the type of the discoveryactivities selected from among information identifying an active scan,information identifying a passive scan, information identifying aGeneric Advertisement Service (GAS) discovery, information identifyingan Access Network Query Protocol (ANQP) discovery, informationidentifying a Wi-Fi Direct discovery, information identifying a NeighborAwareness Networking (NAN) discovery, and information identifying a FastInitial Link Setup (FILS) discovery.
 17. The method of claim 16, whereinproviding the notification responsive to determining the violation ofthe at least one rule comprises providing the notification responsive todetermining that the discovery activities caused the wireless device toconsume power that exceeds a power consumption threshold.
 18. The methodof claim 16, wherein providing the notification responsive todetermining the violation of the at least one rule comprises providingthe notification responsive to determining that a level of a battery ofthe wireless device has fallen below a battery level threshold.
 19. Themethod of claim 16, wherein providing the notification responsive todetermining the violation of the at least one rule comprises providingthe notification responsive to determining that an application thattriggered the discovery activities should not have triggered thediscovery activities.
 20. The method of claim 16, wherein theinformation contained in the notification further comprises a locationof the discovery activities.
 21. A non-transitory machine-readablestorage medium storing instructions that upon execution cause a wirelessdevice to: monitor discovery activities for identifying services ordevices of wireless networks, the discovery activities comprising adiscovery message transmitted by the wireless device to a wirelessnetwork of the wireless networks; determine whether the discoveryactivities cause violation of at least one rule; and responsive todetermining that the discovery activities cause violation of the atleast one rule, provide, to a target entity, a notification containinginformation relating to the monitored discovery activities, theinformation contained in the notification comprising information in thediscovery message transmitted by the wireless device as part of thediscovery activities.